Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2811▼ 175 respecto a la semana anterior
Críticas / altas1356▲ 47 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)267▼ 256 respecto a la semana anterior
15 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Media (6.8) | 0.39% | — | Linkwhisper Link Whisper FreeAI | 21/8/2026 | 26/8/2026 | The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks. | |
| Aplazada | Media (6.5) | 0.30% | — | Linkwhisper Link Whisper PremiumAI | 2/7/2026 | 2/7/2026 | Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions. | |
| Aplazada | Alta (7.1) | 0.25% | — | Linkwhisper Link Whisper FreeAI | 29/6/2026 | 29/6/2026 | Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions. | |
| Aplazada | Alta (7.2) | 0.24% | — | Linkwhisper Link Whisper FreeAI | 29/5/2026 | 21/7/2026 | The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that… | |
| Analizada | Media (6.5) | 0.19% | — | Linkwhisper Link Whisper | 7/4/2026 | 17/6/2026 | The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates. | |
| Aplazada | Alta (7.1) | 0.19% | — | Linkwhisper Link Whisper FreeAI | 20/2/2026 | 17/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.9.2. | |
| Aplazada | Alta (7.1) | 0.22% | — | Linkwhisper Link Whisper FreeAI | 8/1/2026 | 5/10/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.8.8. | |
| Aplazada | Media (6.1) | 0.21% | — | Linkwhisper Link Whisper FreeAI | 6/12/2025 | 17/6/2026 | The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that… | |
| Aplazada | Media (5.3) | 0.22% | — | Linkwhisper Link Whisper FreeAI | 27/10/2025 | 17/6/2026 | Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through <= 0.9.2. | |
| Aplazada | Media (5.3) | 0.36% | — | Linkwhisper Link Whisper FreeAI | 7/1/2025 | 17/6/2026 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Spencer Haws Link Whisper Free link-whisper.This issue affects Link Whisper Free: from n/a through <= 0.7.7. | |
| Aplazada | Media (6.5) | 0.47% | — | Linkwhisper Link Whisper FreeAI | 13/12/2024 | 17/6/2026 | Missing Authorization vulnerability in Link Whisper Link Whisper Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through 0.6.3. | |
| Aplazada | Media (4.3) | 0.21% | — | Linkwhisper Link Whisper FreeAI | 11/4/2024 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.9. | |
| Aplazada | Alta (7.1) | 0.39% | — | Linkwhisper Link Whisper FreeAI | 11/4/2024 | 17/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper Link Whisper Free allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.6.8. | |
| Aplazada | Alta (8.8) | 0.81% | — | Linkwhisper Link Whisper FreeAI | 9/4/2024 | 17/6/2026 | The Link Whisper Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.7.1 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP… | |
| Modificada | Alta (7.2) | 0.56% | — | Linkwhisper Link Whisper Free | 20/12/2023 | 17/6/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5. |